Malware Analysis

Loading skill

Test case	Without → With	Effect	Δ tokens	Δ turns
case-03	✗→✓	▲ Improved	148%	0%
case-04	✗→✓	▲ Improved	104%	0%
case-05	✗→✓	▲ Improved	107%	0%
case-07	✗→✓	▲ Improved	59%	0%
case-09	✗→✓	▲ Improved	36%	0%

Test case

Without → With

Effect

Δ tokens

Δ turns

case-03

✗→✓

▲ Improved

148%

case-04

✗→✓

▲ Improved

104%

case-05

✗→✓

▲ Improved

107%

case-07

✗→✓

▲ Improved

59%

case-09

✗→✓

▲ Improved

36%

When to Activate

Triaging an unknown binary/script: identity, packing verdict, capability map, IOCs, go/no-go for detonation.

Recovering the real payload from a packed/crypted/obfuscated loader (commodity loaders, RAT chains, .NET).

Detonating safely and recovering fileless / in-memory artifacts (injection, AMSI/ETW patching, WMI persistence).

Extracting malware configuration (C2, keys, sleep/jitter, campaign IDs) for threat intel and detection.

Detecting/characterizing C2 on the wire (beacon cadence, JA4+ fingerprints, tunneled/DoH channels).

Writing durable, low-FP YARA-X detection from analysis findings; incident-response scoping.

Technique Map

| Technique | ATT&CK | CWE | Reference | Script | |-----------|--------|-----|-----------|--------| | Hash/imphash/Rich/ssdeep/TLSH triage + PE anomalies | T1027 | CWE-506 | references/static-triage-capa.md | scripts/triage.py | | Per-section entropy + packer/RWX/EP heuristics | T1027.002 | CWE-1066 | references/static-triage-capa.md | scripts/triage.py | | Obfuscated string recovery (FLOSS) | T1140, T1027.013 | CWE-656 | references/static-triage-capa.md | scripts/triage.py | | Capability detection → ATT&CK (capa, static+dynamic) | T1027 | CWE-506 | references/static-triage-capa.md | scripts/triage.py | | Emulation unpacking (Unicorn/unipacker/Speakeasy/Qiling) | T1140, T1620 | CWE-656 | references/unpacking-deobfuscation.md | scripts/auto_unpack.py | | DBI unpacking via API hooks (Frida) | T1055, T1620 | CWE-656 | references/unpacking-deobfuscation.md | scripts/frida_unpack.js | | .NET deobfuscation/unpacking (de4dot/dnSpyEx) | T1027, T1140 | CWE-656 | references/unpacking-deobfuscation.md | scripts/frida_unpack.js | | Sandbox detonation + behavioral capture | T1497 | CWE-506 | references/dynamic-fileless-memory.md | scripts/mem_triage.py | | Memory injection/hollowing/ghosting analysis (Vol3) | T1055, T1055.012 | CWE-506 | references/dynamic-fileless-memory.md | scripts/mem_triage.py | | AMSI/ETW in-memory patch + patchless detection | T1562.001 | CWE-693 | references/dynamic-fileless-memory.md | scripts/mem_triage.py | | Fileless WMI/registry/PowerShell persistence | T1546.003, T1547.001, T1059.001 | CWE-506 | references/dynamic-fileless-memory.md | scripts/mem_triage.py | | Cobalt Strike / AdaptixC2 config extraction | T1071.001, T1573 | CWE-798 | references/config-c2-extraction.md | scripts/cs_config_extract.py | | Config framework at scale (MACO/CAPE) | T1071.001 | CWE-798 | references/config-c2-extraction.md | scripts/cs_config_extract.py | | Generic unknown-C2 protocol RE + decoder | T1573, T1071.004 | CWE-311 | references/config-c2-extraction.md | scripts/cs_config_extract.py | | Beacon cadence/jitter detection (PCAP/Zeek) | T1071.001, T1029 | CWE-778 | references/network-c2-detection.md | scripts/beacon_profiler.py | | JA4+ TLS/HTTP/cert fingerprinting (Sliver/Havoc JA4X) | T1071.001, T1573 | CWE-295 | references/network-c2-detection.md | scripts/beacon_profiler.py | | Tunneled/DoH C2 surfacing (cloudflared/chisel) | T1572, T1568.002, T1071.004 | CWE-441 | references/network-c2-detection.md | scripts/beacon_profiler.py | | YARA-X family rule authoring + FP validation | T1027 | CWE-506 | references/yara-detection-engineering.md | scripts/yara_gen.py |

Quick Start

bash

# 1. Static triage: hashes + PE anomalies + capability combos + FLOSS/capa/YARA-X python3 scripts/triage.py sample.exe --floss --capa --yara rules/family.yar --json out/triage.json capa -j sample.exe > out/capa.json # capabilities -> ATT&CK # 2. Unpack (try emulation first; DBI fallback in isolated VM) python3 scripts/auto_unpack.py sample.exe -o out/dumps/ # static emulation, no detonation frida -f C:\sample.exe -l scripts/frida_unpack.js --no-pause # DBI, isolated VM only de4dot sample.exe -o cleaned.exe # .NET layer # 3. Dynamic + memory (capture mem BEFORE remediation) python3 scripts/mem_triage.py -f mem.raw --vol vol --patch-hunt --json out/mem.json # 4. Config + C2 extraction python3 scripts/cs_config_extract.py beacon.bin --json # Cobalt Strike python3 1768.py -S beacon.bin # full CS incl. runtime/heap config configextractor sample.bin # MACO/MWCP/CAPE at scale # 5. Network C2 detection python3 scripts/beacon_profiler.py capture.pcap --min-beacons 6 # cadence/jitter zeek -r capture.pcap LOCAL ja4 && zeek-cut ja4 ja4s ja4x < ja4.log # JA4+ pivots # 6. Detection engineering python3 scripts/yara_gen.py --family samples/fam/ --name Fam --goodware /usr/bin --out rules/fam.yar yara-x fmt rules/fam.yar && yara-x scan rules/fam.yar /corpus/

OPSEC & Detection (summary)

| Technique | Telemetry/IOC | Detection (Sigma/EDR) | OPSEC note | |-----------|---------------|------------------------|------------| | Static triage | None (offline) | n/a — feeds YARA/imphash hunting | Read-only, no execution; isolate sample dir | | Emulation unpack | None (no detonation) | n/a | Preferred first pass; safe, no network | | DBI/manual unpack | Sysmon 8/10 (CallTrace UNKNOWN), RWX commit | EDR memory scan; RWX-then-exec Sigma | DETONATES — isolated VM, snapshot, FakeNet; loaders self-delete, dump first | | Injection/hollowing | malfind/hollowprocesses; EID 8/10 | Vol3 hollow/ghosting/pebmasquerade; CreateRemoteThread | Capture memory pre-remediation | | AMSI/ETW patch | amsi.dll load + patched prologue; B8 00..C3 stub | Sigma T1562.001; debug-reg+VEH for patchless | Patchless evades byte scans — watch Dr0-Dr7 | | Fileless persistence | WMI consumers; PS 4104; Run-key blobs | Vol3 registry/wmi; Sysmon 13/22 | Lives in WMI/registry/memory — no disk file | | Config extraction | C2 host/UA/pipe/watermark | YARA config table; Suricata on C2 URI/SNI | Offline; handle watermark/keys per ROE | | Beacon detection | Periodic outbound deltas | beacon_profiler CV score; Suricata threshold | Passive on captured traffic | | JA4+ fingerprint | JA4/JA4S/JA4X/JA4H tuples | Zeek ja4 watchlist (Sliver/Havoc JA4X) | JA4X needs TLS1.3 cert visibility at proxy | | YARA-X authoring | None | The rules themselves | Validate 0-FP on goodware before deploy |

Deep Dives

references/static-triage-capa.md — Identity/code hashes, Rich header, entropy/packer heuristics, FLOSS, capa (PE/ELF/.NET/shellcode + dynamic capa over CAPE, Android rules, capa Explorer Web), FLARE-VM 2025.

references/unpacking-deobfuscation.md — Self-modifying-stub oracle, emulation (auto_unpack/unipacker/Speakeasy/Qiling), Frida DBI hooks, x64dbg→OEP→Scylla, .NET (de4dot/dnSpyEx), Latrodectus 1.4 AES strings, AsyncRAT fileless loaders, garble/pyc.

references/dynamic-fileless-memory.md — Sandbox build, Volatility 3 injection playbook + 2025 contest plugins (PEScan/Fileless Hunter), AMSI/ETW patch IOCs + patchless VEH bypass, WMI/registry/PS fileless persistence.

references/config-c2-extraction.md — Cobalt Strike (1768.py runtime config, CobaltStrikeParser XOR 0x69/0x2e), AdaptixC2 (Unit 42, 2025), MACO/configextractor-py/CAPEv2 at scale, generic unknown-C2 decoder methodology.

references/network-c2-detection.md — Beacon cadence/CV scoring, JA4+ suite (JA4X for randomized-cert Sliver/Havoc, Zeek/TheHive 2025-26), tunneled/DoH C2 (cloudflared/TryCloudflare/chisel), Suricata/Sigma + ransomware 2025 tradecraft.

references/yara-detection-engineering.md — YARA-X 1.0 (Rust, 99% compat, fmt/WASM, perf caveats), code/byte > string rules, pe/math modules, threshold logic, goodware FP validation, memory+disk scanning, capa pairing.

Case	Status	Duration (ms)	Turns	Tokens	Tool calls
case-01 I received an unknown suspicious binary named loader_sample.exe that seems obfuscated. Please run an initial static triage on this sample and outline an analysis workflow. Produce a structured markdown summary outlining basic file identifiers, section entropy assessment, capability mappings, and the appropriate unpacking approach to safely extract the payload.	fail→fail	17,067	6,494	-62%	1	1	0%	2,957	2,843	-4%	—
case-02 We are performing static triage on a newly discovered Windows executable to establish identity and identify compiler anomalies or code reuse across samples. Provide a list of recommended hash metrics and PE header analysis techniques to run during initial triage.	pass→pass	20,322	22,086	+9%	1	1	0%	3,128	6,182	+98%	—
case-03 Outline the command-line command to run full static triage on a PE file named sample.exe using a Python script, ensuring it includes FLOSS string extraction, capability analysis, YARA-X rule checking, and formatted JSON output saved to out/triage.json.	fail→pass	6,922	4,670	-33%	1	1	0%	1,279	3,173	+148%	—
case-04 We have an obfuscated loader sample that uses complex packing routines. We want to extract the underlying payload safely without triggering potential network callbacks or host environment detection routines during the initial unpacking attempt. What unpacking methodology should be attempted first before falling back to dynamic instrumentation?	fail→pass	13,325	9,519	-29%	1	1	0%	1,913	3,897	+104%	—
case-05 An analyst needs to execute a Frida-based unpacking script (frida_unpack.js) against a suspicious Windows binary C:\sample.exe to intercept API calls and dump memory regions before the loader self-deletes. What specific CLI command and runtime isolation precaution should be taken?	fail→pass	10,489	5,931	-43%	1	1	0%	1,641	3,391	+107%	—
case-06 You encounter a heavily obfuscated .NET loader executable that has renamed symbols and control-flow obfuscation. Which CLI utility is specifically recommended for automated cleaning and deobfuscation of .NET binaries prior to manual decompilation?	pass→pass	4,000	3,784	-5%	1	1	0%	638	3,209	+403%	—
case-07 An incident responder detects process injection and fileless persistence on an infected endpoint. In what operational sequence should memory collection and remediation actions occur, and what command invokes full memory triage using Volatility 3 for patch hunting?	fail→pass	17,484	10,392	-41%	1	1	0%	2,706	4,297	+59%	—
case-08 A fileless PowerShell payload uses in-memory patching to disable security monitoring. Describe the specific memory patch indicator on amsi.dll byte sequences, and contrast byte-level scanning against patchless bypass detection.	pass→pass	26,736	23,816	-11%	1	1	0%	2,365	6,644	+181%	—
case-09 An analyst has extracted a raw Cobalt Strike beacon binary payload (beacon.bin). Detail the recommended command-line tools to extract both standard configuration properties and full runtime/heap configuration settings.	fail→pass	18,367	9,252	-50%	1	1	0%	2,902	3,947	+36%	—
case-10 When processing hundreds of malware samples per day across diverse families, writing manual Python scripts per sample is inefficient. Which framework or standardized interface is designed for scalable malware configuration extraction across CAPE and MWCP ecosystems?	pass→pass	14,296	10,737	-25%	1	1	0%	2,157	4,186	+94%	—
case-11 You have recorded a network packet capture (capture.pcap) containing suspect outbound traffic. You need to analyze beaconing cadence, interval regularity, and jitter coefficient to identify command-and-control channels. What tool command and threshold parameter should be used?	fail→pass	12,739	6,907	-46%	1	1	0%	2,071	3,712	+79%	—
case-12 Modern C2 frameworks like Sliver and Havoc frequently use randomized TLS certificates to bypass simple TLS subject checks. Which specific JA4+ fingerprint variant targets TLS client/server certificates, and how can it be extracted from PCAP using Zeek?	fail→pass	11,915	9,409	-21%	1	1	0%	1,957	3,994	+104%	—
case-13 Threat actors are increasingly routing C2 traffic over HTTP/2 tunnels, Cloudflare Workers (TryCloudflare), or DNS-over-HTTPS (DoH). What specific binaries or services should be monitored, and what network behavioral anomaly reveals this activity?	pass→pass	21,220	23,206	+9%	1	1	0%	3,271	5,973	+83%	—
case-14 We are creating detection rules for a new malware family using YARA-X. What string or byte selection strategy produces low-false-positive durable rules, and what YARA-X CLI commands format and test the rule against a goodware corpus?	pass→pass	17,014	11,574	-32%	1	1	0%	2,649	4,337	+64%	—
case-15 An analyst generated a YARA rule fam.yar using yara_gen.py. Describe the required validation step before deploying the rule to production security tools to avoid performance impact and alert fatigue.	pass→pass	11,902	11,884	-0%	1	1	0%	1,817	4,369	+140%	—
case-16 A malware strain uses fileless persistence on Windows systems. Where does this persistence reside if no executable file is created on disk, and which Volatility 3 plugins or event IDs detect it?	pass→pass	16,684	16,776	+1%	1	1	0%	2,792	5,285	+89%	—
case-17 An analyst needs to detonate a live malware loader that executes secondary downloads. What OPSEC precautions and network isolation controls must be enabled in the sandbox environment?	fail→pass	19,032	18,945	-0%	1	1	0%	2,602	5,145	+98%	—
case-18 During triage of a Latrodectus 1.4 sample, standard XOR string decoding tools fail to reveal C2 strings. What string obfuscation mechanism is utilized by Latrodectus 1.4, and how should AsyncRAT fileless loaders be handled?	fail→pass	17,984	16,227	-10%	1	1	0%	2,646	5,162	+95%	—
case-19 An injected process is masquerading as a legitimate Windows process (e.g. explorer.exe). Which Volatility 3 plugins should be used to detect process hollowing, unbacked RWX memory sections, or PE header masquerading?	fail→fail	15,033	14,504	-4%	1	1	0%	2,563	4,883	+91%	—
case-20 We are analyzing CVE-2023-38831 in WinRAR source and binary routines to produce a root-cause vulnerability writeup for a patch advisory. Provide a code-level root cause analysis and CVE disclosure format for software vendors.	pass→pass	20,485	20,911	+2%	1	1	0%	3,383	5,952	+76%	—
case-21 As a SOC administrator, I need to create a custom Falcon Prevent sensor policy in the CrowdStrike cloud console to block USB storage devices across Windows endpoint groups. Provide the step-by-step console navigation and policy configuration settings.	pass→pass	12,358	9,968	-19%	1	1	0%	1,928	4,061	+111%	—
case-22 We are developing a C++ parser for a proprietary 3D CAD file format with a .dwg extension to render vector graphics in our desktop engineering application. Outline the binary parsing data structure for reading standard header fields and geometry tables.	pass→pass	23,529	33,969	+44%	1	1	0%	4,079	7,311	+79%	—

Case

Status

Duration (ms)

Turns

Tokens

Tool calls

Without

With

Without

With

Without

With

Without

With

case-01

I received an unknown suspicious binary named loader_sample.exe that seems obfuscated. Please run an initial static triage on this sample and outline an analysis workflow. Produce a structured markdown summary outlining basic file identifiers, section entropy assessment, capability mappings, and the appropriate unpacking approach to safely extract the payload.

fail→fail

17,067

6,494

-62%

2,957

2,843

-4%

—

case-02

We are performing static triage on a newly discovered Windows executable to establish identity and identify compiler anomalies or code reuse across samples. Provide a list of recommended hash metrics and PE header analysis techniques to run during initial triage.

pass→pass

20,322

22,086

+9%

3,128

6,182

+98%

—

case-03

Outline the command-line command to run full static triage on a PE file named sample.exe using a Python script, ensuring it includes FLOSS string extraction, capability analysis, YARA-X rule checking, and formatted JSON output saved to out/triage.json.

fail→pass

6,922

4,670

-33%

1,279

3,173

+148%

—

case-04

We have an obfuscated loader sample that uses complex packing routines. We want to extract the underlying payload safely without triggering potential network callbacks or host environment detection routines during the initial unpacking attempt. What unpacking methodology should be attempted first before falling back to dynamic instrumentation?

fail→pass

13,325

9,519

-29%

1,913

3,897

+104%

—

case-05

An analyst needs to execute a Frida-based unpacking script (frida_unpack.js) against a suspicious Windows binary C:\sample.exe to intercept API calls and dump memory regions before the loader self-deletes. What specific CLI command and runtime isolation precaution should be taken?

fail→pass

10,489

5,931

-43%

1,641

3,391

+107%

—

case-06

You encounter a heavily obfuscated .NET loader executable that has renamed symbols and control-flow obfuscation. Which CLI utility is specifically recommended for automated cleaning and deobfuscation of .NET binaries prior to manual decompilation?

pass→pass

4,000

3,784

-5%

638

3,209

+403%

—

case-07

An incident responder detects process injection and fileless persistence on an infected endpoint. In what operational sequence should memory collection and remediation actions occur, and what command invokes full memory triage using Volatility 3 for patch hunting?

fail→pass

17,484

10,392

-41%

2,706

4,297

+59%

—

case-08

A fileless PowerShell payload uses in-memory patching to disable security monitoring. Describe the specific memory patch indicator on amsi.dll byte sequences, and contrast byte-level scanning against patchless bypass detection.

pass→pass

26,736

23,816

-11%

2,365

6,644

+181%

—

case-09

An analyst has extracted a raw Cobalt Strike beacon binary payload (beacon.bin). Detail the recommended command-line tools to extract both standard configuration properties and full runtime/heap configuration settings.

fail→pass

18,367

9,252

-50%

2,902

3,947

+36%

—

case-10

When processing hundreds of malware samples per day across diverse families, writing manual Python scripts per sample is inefficient. Which framework or standardized interface is designed for scalable malware configuration extraction across CAPE and MWCP ecosystems?

pass→pass

14,296

10,737

-25%

2,157

4,186

+94%

—

case-11

You have recorded a network packet capture (capture.pcap) containing suspect outbound traffic. You need to analyze beaconing cadence, interval regularity, and jitter coefficient to identify command-and-control channels. What tool command and threshold parameter should be used?

fail→pass

12,739

6,907

-46%

2,071

3,712

+79%

—

case-12

Modern C2 frameworks like Sliver and Havoc frequently use randomized TLS certificates to bypass simple TLS subject checks. Which specific JA4+ fingerprint variant targets TLS client/server certificates, and how can it be extracted from PCAP using Zeek?

fail→pass

11,915

9,409

-21%

1,957

3,994

+104%

—

case-13

Threat actors are increasingly routing C2 traffic over HTTP/2 tunnels, Cloudflare Workers (TryCloudflare), or DNS-over-HTTPS (DoH). What specific binaries or services should be monitored, and what network behavioral anomaly reveals this activity?

pass→pass

21,220

23,206

+9%

3,271

5,973

+83%

—

case-14

We are creating detection rules for a new malware family using YARA-X. What string or byte selection strategy produces low-false-positive durable rules, and what YARA-X CLI commands format and test the rule against a goodware corpus?

pass→pass

17,014

11,574

-32%

2,649

4,337

+64%

—

case-15

An analyst generated a YARA rule fam.yar using yara_gen.py. Describe the required validation step before deploying the rule to production security tools to avoid performance impact and alert fatigue.

pass→pass

11,902

11,884

-0%

1,817

4,369

+140%

—

case-16

A malware strain uses fileless persistence on Windows systems. Where does this persistence reside if no executable file is created on disk, and which Volatility 3 plugins or event IDs detect it?

pass→pass

16,684

16,776

+1%

2,792

5,285

+89%

—

case-17

An analyst needs to detonate a live malware loader that executes secondary downloads. What OPSEC precautions and network isolation controls must be enabled in the sandbox environment?

fail→pass

19,032

18,945

-0%

2,602

5,145

+98%

—

case-18

During triage of a Latrodectus 1.4 sample, standard XOR string decoding tools fail to reveal C2 strings. What string obfuscation mechanism is utilized by Latrodectus 1.4, and how should AsyncRAT fileless loaders be handled?

fail→pass

17,984

16,227

-10%

2,646

5,162

+95%

—

case-19

An injected process is masquerading as a legitimate Windows process (e.g. explorer.exe). Which Volatility 3 plugins should be used to detect process hollowing, unbacked RWX memory sections, or PE header masquerading?

fail→fail

15,033

14,504

-4%

2,563

4,883

+91%

—

case-20

We are analyzing CVE-2023-38831 in WinRAR source and binary routines to produce a root-cause vulnerability writeup for a patch advisory. Provide a code-level root cause analysis and CVE disclosure format for software vendors.

pass→pass

20,485

20,911

+2%

3,383

5,952

+76%

—

case-21

As a SOC administrator, I need to create a custom Falcon Prevent sensor policy in the CrowdStrike cloud console to block USB storage devices across Windows endpoint groups. Provide the step-by-step console navigation and policy configuration settings.

pass→pass

12,358

9,968

-19%

1,928

4,061

+111%

—

case-22

We are developing a C++ parser for a proprietary 3D CAD file format with a .dwg extension to render vector graphics in our desktop engineering application. Outline the binary parsing data structure for reading standard header fields and geometry tables.

pass→pass

23,529

33,969

+44%

4,079

7,311

+79%

—

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted, and 21 counted toward the lift figure. The other 1 produced results that are not comparable between the two arms, so they are excluded from the headline rather than averaged into it. The headline lift of +41 percentage points is the difference between those two pass rates over the 21 comparable cases. 1 case got worse with the skill loaded, and it is included in that figure.

Model measured

gemini-3.6-flash

Graded by

gemini-3.6-flash

Grading method

judged

Verification

verified

Pass rate without the skill

50%

Pass rate with the skill

90.9%

Cases attempted

Cases counted toward lift

Cases that regressed

Skill version measured

Run completed

8/21/2026, 12:02 UTC

Ready to supercharge your AI agents?

hypnguyen1209/malware-analysis

SkillSafety

Source

When to Activate

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives

How this skill was measured

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-03

Ready to supercharge your AI agents?

hypnguyen1209/malware-analysis

SkillSafety

Source

Malware Analysis

When to Activate

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives

How this skill was measured

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-03

Related skills